Which of the following is the primary objective of a rootkit?

The correct answer is B, It replaces legitimate programs. A rootkit is malicious software used after compromise to hide the attacker’s presence, maintain privileged access, and avoid detection. CEH-aligned material describes rootkits as tools that obscure system compromise by replacing or substituting administrator utilities with modified versions that hide malicious activity. Linux rootkit material also states that rootkits contain replacement executables for critical operating system components, used to hide evidence and provide backdoor access. Therefore, among the options, replacing legitimate programs is the best match. Option A describes a backdoor concept more generally. Option C describes a vulnerability/exploitation condition, not a rootkit’s purpose. Option D may describe one possible backdoor behavior, but it is not the primary rootkit objective. Rootkits commonly hide files, processes, registry entries, logs, and malicious services, making detection and removal difficult.